3 ms·
TrustZone is essentially an ISA extension, similar to Intel's TXT and SGX to provide a trusted execution environment. You can trivially avoid it by never runnin
by gsnedders 8y ago
TrustZone is essentially an ISA extension, similar to Intel's TXT and SGX to provide a trusted execution environment. You can trivially avoid it by never running any of the related instructions.
- monocasa 8y agoIt's more of an extra address bit and processor mode. It doesn't have related instructions like TXT and SGX, but instead is structured more like a hypervisor.
- 0xakhil 8y agoI am not sure if this is correct. There are related instructions like 'smc' that helps to switch to secure world.
- monocasa 8y agoOK, so there's the one instruction to do a system call that hits secure mode. It's equivalent to svc or hvc, but hits EL3 (secure mode) rather than EL2 (hypervisor mode) or EL1 (supervisor mode). It's very very different than the dozen or so instructions to setup TXT or SGX that sits off to the side of the main OS rather than running like a super hypervisor. If you're going to compare it to something, it's way more like SMM on x86. Source: I've ported a kernel to EL3 (secure mode).
- floatboth 8y agoYou generally do want to run the reference (BSD licensed) Trusted Firmware though. It implements PSCI at least.